Multiple IP on same NIC : when could be useful?

Question

I've been in a office where each workstation(Windows XP) have configured two static IP Address on the same NIC one for net : 192.168.3.0 and another for accessing net : 192.168.200.0 .

Since the IP address for net 192.168.200.0 is given only for accessing an Asterisk VoIP Server that has ip address : 192.168.200.125.

After seeing this type of configuration, i have some doubt ... it's not better adding a server with multiple ip address configured and then set a static route on the default gateway of the main network ?

Can achieve better performance with multiple IP Address or with a static route on default gateway?

When multiple IP Address on single NIC is a better choice ?

Answer 1

Multiple addresses on a single NIC is primarily used when you have multiple logical networks on a single physicle network. For example, Your primary workstations use 192.168.200.0/24 You have phones and a couple of workstations which should never talk to the world. Those you give addresses in 192.168.3.0/24. Now, your fileserver has an address of 192.168.200.253, these workstations need to access the file server. You could send them to your default gw, which will turn around and route them back to the file server, causing the packets to hit your network twice, or you can add 192.168.3.253 to your file server, allowing the local only systems to talk to it directly. and still letting you block all traffic not coming from 192.168.200.0/24 on your router. Make sense?

Answer 2

Richard has given you a good answer for a reason in favour of multiple IP addresses per workstation. However, you should consider the overhead this introduces, as now each workstation has to have static IP addresses, which have to be configured individually and manually. As soon as you get to something like 50 workstations, this can become a real chore.

So, if your network is growing or already large, DHCP assigned IP addresses are the way to go. And for servers/services that shouldn't be accessible from the outside, create a DMZ with its own firewall and add some routes.

Answer 3

I would not recommend putting multiple IP addresses on a single NIC for multiple workstations in an organization. On a server there are many reasons for doing so: Hosting multiple websites and domains, bridging between two networks, etc. etc. For workstations, however, we want to keep the network configuration as simple as possible because there are more of these to maintain than servers and routers, and because we want end devices like workstations to be flexible and for infrastructure pieces like network and servers to be more stable and static (as a rule of thumb). If, as you say, there is only one Asterisk server justifying the workstations having accessibility to the second network, then I believe that it would be more appropriate to tackle the related security issues from the server device side rather than the workstation side. Specifically, the Asterisk VoIP server sounds like a great candidate for accessibility via a Firewall with NAT. It can keep its own network via NAT and be restricted to only your workstation traffic via the Firewall (assuming that there is a compelling reason to keep it on its own network).